Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2556▼ 319 respecto a la semana anterior

Críticas / altas1344▲ 80 respecto a la semana anterior

Nueva explotación activa (KEV)5▼ 7 respecto a la semana anterior

Sin puntuar (sin CVSS)62▼ 466 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2018-25435	Aplazada	Media (6.9)	0.16%	—	Zeuscart^AI	1/6/2026	22/7/2026	ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of victims by crafting malicious requests. Attackers can deactivate customer accounts via the admin interface by tricking users into visiting attacker-controlled pages that submit requests…
CVE-2014-3868	Modificada	Alta (8.8)	2.5%	—	Zeuscart	31/1/2020	17/6/2026	Multiple SQL injection vulnerabilities in ZeusCart 4.x.
CVE-2015-2182	Modificada	Media (4.3)	4.5%	—	Ajsquare Zeuscart	11/3/2015	17/6/2026	Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322.
CVE-2010-5322	Modificada	Media (4.3)	2.6%	—	Ajsquare Zeuscart	11/3/2015	16/6/2026	Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php.
CVE-2015-2184	Modificada	Media (5)	8.4%	—	Ajsquare Zeuscart	10/3/2015	17/6/2026	ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function.
CVE-2015-2183	Modificada	Alta (7.5)	3.5%	—	Zeuscart	10/3/2015	17/6/2026	Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/.
CVE-2009-4940	Modificada	Alta (7.5)	0.92%	—	Zeuscart	22/7/2010	16/6/2026	SQL injection vulnerability in index.php in Zeus Cart 2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the maincatid parameter in a showmaincatlanding action.
CVE-2008-5216	Modificada	Alta (7.5)	0.97%	—	AJ Square Zeuscart	24/11/2008	16/6/2026	SQL injection vulnerability in category_list.php in AJ Square ZeusCart 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.